fix: pass --repo to gh release upload in publish workflow - #31
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
✅ Grippy Review — PASSScore: 100/100 | Findings: 0 Commit: 357162e |
There was a problem hiding this comment.
Pull request overview
Updates the publish workflow so the release-assets job can upload artifacts with gh even without a checked-out git repository by explicitly providing the repository context.
Changes:
- Add
GH_REPOenv var (github.repository) to the release upload step. - Pass
--repo "$GH_REPO"togh release uploadto avoid relying on local git context.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| TAG_NAME: ${{ github.ref_name }} | ||
| run: gh release upload "$TAG_NAME" dist/* sbom/* --clobber | ||
| GH_REPO: ${{ github.repository }} | ||
| run: gh release upload "$TAG_NAME" dist/* sbom/* --clobber --repo "$GH_REPO" |
There was a problem hiding this comment.
The run: command is escaping the double quotes (e.g., \"$TAG_NAME\"). In a YAML run: scalar this is unnecessary and makes the command harder to read/maintain; use normal shell quoting ("$TAG_NAME", "$GH_REPO") without the backslashes so the workflow file matches typical GitHub Actions conventions.
The release-assets job doesn't checkout the repo, so
ghhas no git context. Pass--repovia env var. Uses env var pattern per Actions security best practices.